feature: user login into project with highest privilege automatically

pkg/apigateway/handler/auth.go

@@ -319,6 +319,35 @@ func (h *AuthHandlers) doCredentialLogin(ctx context.Context, req *http.Request,
 			}
 		}
 	}
+	if len(tenant) == 0 {
+		token3, ok := token.(*mcclient.TokenCredentialV3)
+		if ok {
+			targetLevel := rbacutils.ScopeProject
+			targetProjId := ""
+			for _, r := range token3.Token.RoleAssignments {
+				level := rbacutils.ScopeProject
+				if len(r.Policies.System) > 0 {
+					level = rbacutils.ScopeSystem
+				} else if len(r.Policies.Domain) > 0 {
+					level = rbacutils.ScopeDomain
+				}
+				if len(targetProjId) == 0 || level.HigherThan(targetLevel) {
+					targetProjId = r.Scope.Project.Id
+					targetLevel = level
+				}
+			}
+			if len(targetProjId) > 0 {
+				ntoken, e := auth.Client().SetProject(targetProjId, "", "", token)
+				if e != nil {
+					log.Errorf("fail to change to project %s(%s), reset to empty", targetProjId, e)
+				} else {
+					token = ntoken
+					tenant = targetProjId
+					body.(*jsonutils.JSONDict).Set("scope", jsonutils.NewString(string(targetLevel)))
+				}
+			}
+		}
+	}
 	if len(tenant) == 0 {
 		s := auth.GetAdminSession(ctx, FetchRegion(req), "")
 		projects, e := modules.UsersV3.GetProjects(s, token.GetUserId())

pkg/mcclient/token3.go

@@ -131,7 +131,7 @@ type KeystoneTokenV3 struct {
 	// 认证上下文
 	Context SAuthContext `json:"context"`
 
-	// 当用户认证时未指定scoepe时，会返回改用户所有的项目
+	// 当用户认证时未指定scope时，会返回该用户所有的项目
 	Projects []KeystoneProjectV3 `json:"projects"`
 	// 返回用户在所有项目的所有角色信息
 	RoleAssignments []api.SRoleAssignment `json:"role_assignments"`